Which Controls Do the Most for Cyber Insurability

Which Controls Do the Most for Cyber Insurability

Speakers: Daniel Bowden, Global Business CISO, Marsh McLennan

Conference: Black Hat MEA

YouTube: https://www.youtube.com/watch?v=-tXGU6eBHA4

Overview

In an era where cyber attacks are increasingly systemic and unpredictable, the traditional models used by insurers to assess and price risk are struggling to keep pace. This keynote address by Daniel Bowden, Global Business CISO for Marsh McLennan, cuts straight to a critical question for security professionals and business leaders alike: which cyber controls genuinely move the needle in terms of both reducing loss and improving an organization's cyber insurability? Bowden, representing one of the world's largest insurance and cyber insurance brokers, leverages Marsh McLennan's extensive data and advisory experience to provide a data-driven answer.

The talk delves into the specific security measures that insurers consistently prioritize, the safeguards proven to meaningfully reduce the blast radius of an attack, and the practices that elevate an organization's security posture to make it more attractive and less risky in the eyes of underwriters. While many controls contribute to overall security, Bowden highlights a surprising yet foundational element as the single most impactful factor for deterring breaches: Incident Response Planning.

This session is crucial for CISOs, risk managers, and business executives grappling with escalating cyber threats and the complexities of securing adequate cyber insurance coverage. By focusing on the controls that truly matter, organizations can optimize their security investments, enhance their resilience, and navigate the evolving landscape of cyber risk with greater confidence, transforming the "unthinkable" into a manageable reality.

Background

▶ Watch: Introduction to cyber insurability and Marsh McLennan (0:00)

The landscape of cyber risk has dramatically shifted, with attacks becoming more sophisticated, frequent, and costly. This volatility presents a significant challenge for cyber insurance carriers, who historically relied on static risk assessment methods, often involving simple self-attestation questionnaires. Organizations would merely confirm the presence of certain controls, such as an Endpoint Detection and Response (EDR) solution, without deeper scrutiny into their effective deployment, tuning, or operational maturity. This superficial approach made it difficult for insurers to accurately model risk and predict potential losses.

Marsh McLennan, as a global leader in insurance brokerage and advisory services, has been at the forefront of evolving these assessment methodologies. Daniel Bowden explains that their firm, which includes Marsh, Guy Carpenter, Mercer, and Oliver Wyman, advises clients on how to enhance their insurability. The core question for insurability, Bowden notes, is "how likely are you to have a breach?" This mirrors the assessment criteria for third-party risk, highlighting a common thread in risk management. The challenge lies not just in deploying controls, but in deploying them properly and understanding their true impact on risk reduction.

To address this, Marsh McLennan and other brokers are moving towards a more proactive engagement model, akin to car insurance companies using driving monitors. They encourage clients to allow deeper assessments of their controls, moving beyond simple attestation to a more robust validation of security posture. This shift is driven by the recognition that while protective controls are essential, incidents are inevitable. The critical distinction, and the focus of much of Marsh McLennan's research, is preventing an incident – any deviation from normal or acceptable activity – from escalating into a breach, defined as an unauthorized disclosure of data. The goal is to equip organizations with the means to quickly divert and respond to incidents before they become reportable, costly breaches.

Key Findings

▶ Watch: Goalkeeper analogy for assessing control effectiveness (8:20)

Daniel Bowden's presentation reveals several pivotal findings derived from Marsh McLennan's extensive research and client engagements, offering concrete guidance for improving cyber insurability and resilience.

Foremost among these findings is the identification of Incident Response Planning (IRP) as the single most impactful control for deterring breaches. Through sophisticated data analytics, Marsh McLennan's data scientists developed a "signal strength" metric, an analogy to evaluating goalkeepers in a normalized environment. This methodology assesses which security controls make the most "saves" (prevent breaches) when faced with an equal number of "shots" (incidents), effectively leveling the playing field to determine true effectiveness. The comprehensive, top-to-bottom incident response planning process consistently demonstrated the highest signal strength.

Another significant observation from Marsh McLennan's checkpoint surveys between 2023 and 2025 indicated a notable increase in client investment and deployment in managing high-rated vulnerabilities and critical-rated vulnerabilities. While other controls remained relatively static, the focus on vulnerability management saw a substantial uptick. Bowden speculates this surge might be driven by increasing regulatory scrutiny, citing an instance where a regulator performed a no-notice audit, specifically checking endpoint security, access control, and vulnerabilities.

The importance of tabletop exercises also emerged as a critical component of effective IRP. These simulations, especially when involving organizational leadership, are invaluable for truly understanding an organization's risk tolerance and ensuring all stakeholders comprehend their roles during a crisis. Brokers often include these exercises as part of their service, making them an accessible resource for clients.

Finally, the talk underscored the concept of control drift. Security controls, even when properly deployed initially, naturally degrade or become misconfigured over time due to changes in the environment, assets, and personnel. This necessitates continuous auditing and re-validation, rather than a one-time deployment mentality. Marsh McLennan's own practices, such as annual audits of tens of thousands of service accounts and network segmentation controls, exemplify this ongoing commitment to control assurance.

Technical Deep Dive

▶ Watch: Tabletop exercises for leadership risk tolerance (10:30)

The core of Daniel Bowden's technical deep dive revolves around the nuanced definition and implementation of Incident Response Planning (IRP), distinguishing it from a mere collection of incident response tools or processes. Marsh McLennan defines comprehensive IRP as a fully "drawn-out incident response planning process" where every level of the organization, from top leadership to frontline staff, understands their specific roles, relevant policies, and decision-making authority. This includes clarity on who manages information, and who makes critical decisions regarding containment, eradication, and recovery during an incident.

Bowden illustrates the importance of this integrated approach with the "funnel slide" analogy, a common CISO presentation technique. This conceptual model shows how various attack surface controls (e.g., firewalls, email security gateways like Proofpoint) filter out a vast majority of threats at the top of the funnel. However, for the critical few incidents that inevitably bypass these initial defenses, a robust IRP dictates "what happens to those 20" (out of an initial million events). This involves clearly defined processes for triage, categorization, and decision-making on crucial aspects such as notifying affected clients or business units, and determining if an event is "material" enough to require regulatory reporting. In large, globally distributed organizations with multiple CEOs, COOs, and CIOs, a well-defined IRP is paramount to avoid chaos and ensure efficient, coordinated action.

The methodology for assessing control effectiveness, termed "signal strength" by Marsh McLennan's data scientists, provides a deeper technical understanding of why IRP stands out. This approach moves beyond simple metrics like "goals against per game" (analogous to total incidents) to evaluate the inherent "save-making ability" of a control. By hypothetically subjecting all controls (goalkeepers) to an equal number of "shots" (incidents) in a standardized environment, they identify which controls are most effective at preventing a "made goal" (breach). This analytical rigor underpins the assertion that comprehensive IRP, which orchestrates the entire response, has the highest signal strength. The speaker notes that specific aspects of IR, from basic capabilities to full-scale planning with tabletop exercises, progressively stack up in terms of their effectiveness, with a completely drawn-out IRP at the highest end of the spectrum.

Beyond IRP, the discussion touches on other critical technical controls and their operational challenges. The observed increase in focus on vulnerability management (specifically high and critical rated vulnerabilities) highlights the ongoing struggle to manage technical debt and patch cycles effectively. The mention of regulators checking endpoint security, access control, and vulnerabilities underscores the foundational nature of these controls. However, Bowden stresses that merely deploying these controls is insufficient. The concept of control drift is a significant technical implication: due to constant changes in the IT environment—new assets, employee turnover, configuration changes—controls can become ineffective over time. Marsh McLennan's internal practice of annual audits for "tens of thousands of service accounts" and continuous review of "network segmentation controls" illustrates the necessary technical discipline to combat this drift, ensuring controls remain properly installed and effective. This continuous assurance is not a one-time project but an ongoing operational imperative.

Demo / Proof of Concept

▶ Watch: Resilience and continuous auditing of security controls (16:00)

The talk, "Which Controls Do the Most for Cyber Insurability," delivered by Daniel Bowden, did not include a live technical demonstration or a proof of concept in the traditional sense. Instead, the speaker presented insights derived from extensive research, analytics, and advisory experience accumulated by Marsh McLennan as a leading global cyber insurance broker.

The "signal strength" methodology, while a powerful analytical framework used by Marsh McLennan's data scientists to evaluate control effectiveness, was described conceptually rather than demonstrated with a specific tool or output. The presentation relied on aggregated data, case studies, and strategic recommendations based on the firm's unique vantage point, observing "a dozen incidents from clients a day." This approach provided a high-level strategic and analytical perspective on cyber insurability rather than a hands-on technical walkthrough.

Defensive Implications

▶ Watch: Why you should trust your cyber insurance broker (18:30)

The insights shared by Daniel Bowden offer several critical defensive implications for organizations aiming to enhance their security posture and improve their cyber insurability.

Firstly and most importantly, organizations must prioritize and mature their Incident Response Planning (IRP). This goes beyond simply having a written plan; it requires a comprehensive, organization-wide framework where every individual, from the CEO to the security analyst, understands their precise role, responsibilities, and decision-making authority during an incident. Defenders should focus on clearly defining processes for incident triage, categorization, containment, eradication, recovery, and communication protocols for internal stakeholders, clients, and regulators. Regular tabletop exercises involving executive leadership are indispensable for testing the plan's efficacy and fostering a shared understanding of risk tolerance. Organizations should actively engage their cyber insurance brokers, as many offer or can facilitate these crucial exercises.

Secondly, continuous control assurance is paramount. The phenomenon of "control drift" means that even well-implemented security measures can degrade over time. Defenders must establish robust and recurring audit programs to validate the proper installation, configuration, and effectiveness of all critical controls. This includes, but is not limited to, annual audits of service accounts, regular reviews of network segmentation, and continuous monitoring of endpoint security and access control. This proactive approach ensures that controls remain functional and aligned with the organization's evolving risk profile.

Thirdly, while IRP is the ultimate differentiator, organizations should not neglect foundational security controls. The speaker highlighted that regulators, in no-notice audits, specifically scrutinize endpoint security, access control, and vulnerability management. Therefore, continued investment in these areas, particularly in aggressively managing high-rated and critical-rated vulnerabilities, remains a non-negotiable aspect of a strong defensive strategy and regulatory compliance.

Finally, and perhaps most strategically, organizations should cultivate a strong relationship with their cyber insurance broker. As Bowden emphasizes, brokers possess unparalleled insight into the real-world impact of cyber incidents across a vast client base. They can offer invaluable advice on what controls truly matter, what pitfalls to avoid during an incident, and how to best position an organization for favorable insurance terms. Listening to and trusting the broker's advice, informed by their daily exposure to numerous incidents, can significantly enhance an organization's ability to respond effectively and manage its overall cyber risk.

Key Takeaways

• Incident Response Planning (IRP) is the single most impactful control for cyber insurability and breach deterrence. A well-defined, top-to-bottom IRP, where everyone understands their roles and decision-making authority for containment, eradication, and recovery, is crucial.
• Tabletop exercises are essential for validating IRP and understanding leadership's risk tolerance. Engaging executives in these simulations helps solidify organizational response capabilities and identifies potential gaps.
• Security controls are subject to "drift" and require continuous auditing. Merely deploying a control once is insufficient; ongoing validation of configuration and effectiveness (e.g., annual audits of service accounts and network segmentation) is critical to combat degradation.
• Foundational controls like endpoint security, access control, and vulnerability management remain critical. Regulators are increasingly scrutinizing these areas, driving increased organizational focus, particularly on high and critical vulnerabilities.
• Leverage your cyber insurance broker's expertise. Brokers see a multitude of incidents daily and can provide invaluable, experience-based advice on effective controls, incident response strategies, and navigating the complexities of cyber insurance.
• The goal is to prevent incidents from becoming breaches. Effective IRP focuses on rapidly disintermediating an incident to prevent unauthorized data disclosure and avoid reportable breach events.

About the Speaker(s)

Daniel Bowden is the Global Business CISO for Marsh McLennan, a prominent global professional services firm encompassing leading brands such as Marsh, Guy Carpenter, Mercer, and Oliver Wyman. In his role, Bowden oversees the Chief Information Security Officers for each of Marsh McLennan's four operating companies and works closely with the firm's cyber advisory and brokerage businesses.

This unique position grants him an unparalleled perspective on the intersection of cyber security, risk management, and the cyber insurance market. Marsh McLennan is recognized as one of the largest, if not the largest, insurance and cyber insurance brokers globally, providing Bowden with access to extensive research, analytics, and real-world incident data from a vast client base. His insights are therefore rooted in a deep understanding of what genuinely impacts an organization's security posture and its insurability. Bowden also draws on his personal experience as a CISO in prior roles and even as a Marsh customer, highlighting the practical lessons learned from navigating security incidents firsthand.